Encryption Utility Firm Accused of Bundling Malware Features in Products

An Italian enterprise that sells what it describes as a legit encryption utility is becoming used as malware packer for the cloud-sent destructive GuLoader dropper, assert researchers. The instrument, according a modern investigation, creates GuLoader samples and aids the malware prevent antivirus detection.

For its aspect, the firm promises it has taken techniques to avoid bad actors from utilizing its wares for sick.

In accordance to scientists at Verify Place, the firm identified as CloudEyE is wanting to get a piece of the conventional packer and crypter market – a thriving arena that caters to malware authors on the lookout for obfuscation for their wares.

GuLoader is a prevalent dropper that compromises targets and then provides next-stage malware. It is been frequently up-to-date over the study course of 2020, according to Look at Issue, with new binaries sporting sandbox evasion strategies, code randomization characteristics, command-and-handle (C2) URL encryption and additional payload encryption.

“As a consequence, we can reasonably suppose that guiding GuLoader there is a major new service” providing various forms of encryption, according to the scientists.

Further investigation uncovered just these a services, which researchers explained is “created and preserved by an Italian enterprise that pretends to be fully legitimate and aboveboard, and even has a internet site in Clearnet that uses the .eu area zone,” the analysis concluded.

When Threatpost attained out to CloudEyE, a spokesperson reported that the firm “can enable [security researchers] by revoking CloudEyE licenses to the users who are abusing our item.” The particular person included, “CloudEyE is not related any longer to hack community forums or other hackers’ community forums.”

From DarkEyE to to CloudEyE to GuLoader

In Verify Point’s the latest investigation of GuLoader, which has ramped up its activity so much this yr, the company discovered that a different malware sample was getting flagged at as a variant of the dropper. On the other hand, there was just one very important difference – these samples did not have URLs for downloading a next payload.

Additional investigation pointed to the malware being something identified as DarkEyE Protector, which demonstrates up in underground forum threads from as considerably back again as 2014, posted by a person called “sonykuccio.”

“The advertisements describe DarkEyE as a crypter that can be employed with unique malware this sort of as stealers, keyloggers and RATs (distant accessibility trojans), and would make them entirely undetectable for antiviruses (FUD),” explained the scientists. “This left us with no question that this application was created to guard malware from discovery by antiviruses, as the authors didn’t ignore to emphasize that they ‘don’t choose any accountability for the use’ of DarkEyE.”

The DarkEyE samples have substantially overlap with GuLoader samples. Both of those are composed in VisualBasic, include a shellcode encrypted with 4-byte XOR keys, and have the very same payload decryption process – which points out the mistaken identity in Check Point’s antimalware investigation.

The ads for DarkEyE incorporate a site handle to go to for additional facts: securitycode[.]eu. Quickly forward to 2020, and that exact address is now focused on what seems to be a similar product or service, identified as CloudEyE. This is advertised as protection computer software supposed for “protecting Home windows purposes from cracking, tampering, debugging, disassembling, dumping,” according to the internet site.

“But [elsewhere on the website] incorporates numerous YouTube video clip tutorials on how to use CloudEyE, and, as it turned out, how to abuse Google Push and OneDrive,” in accordance to Verify Place. “[These] demonstrate how to retail outlet payloads on cloud drives…which typically carry out antivirus examining and technically don’t allow the upload of malware. Even so, payload encryption implemented in CloudEyE will help to bypass this limitation.”

And even more, these video clips contained the identical URL sample that’s discovered in GuLoader samples.

“[The pattern is] a placeholder for a URL that is utilized in some of GuLoader samples for downloading joined files (decoy images in our previous research),” the researchers said. “Way also significantly coincidence for us to come across it here!”

The analysts, pursuing a hunch, downloaded CloudEyE and employed it to encrypt an executable file, turning it into a comprehensive-fledged binary that can unpack alone and fetch further payloads – just like GuLoader. In the success of the emulation, Check out Place discovered that CloudEyE makes samples that are without a doubt universally acknowledged as GuLoader malwar.

“We resolved to analyze it manually and look at with a authentic GuLoader sample that we observed in the wild,” the scientists explained.

Making use of a recent GuLoader sample which downloads the Formbook malware, the researchers decrypted the shellcode from both of those CloudEyE and GuLoader.

“To make it more challenging for automated examination and possibly also to protect against automated decryption, the shellcode commences from a random stub and is prepended with a bounce in excess of this stub,” Look at Point’s evaluation defined. “In both samples, the similar room on the stack is reserved for a structure with worldwide variables. Variables in the framework have the identical offset. Most of the code chunks differ only thanks to the applied randomization methods. The handy code is the identical in both of those samples.”

Also, the URLs for downloading the payload are the exact, as well.

“We can therefore conclude that the samples are just about equivalent and vary only usually thanks to applied code randomization strategies,” according to the analysts.

Even so, the CloudEyE spokesperson said that DarkEyE Protector was in no way intended to be malicious — instead, it has been cracked, tampered with and abused multiple instances, which is why the project was discontinued. “You can see some YouYube video clips as proof,” the individual explained.

Attribution

As for who’s guiding CloudEye, Verify Stage researchers begun with the “sonykuccio” identify uncovered in the DarkEyE advertisements.

“Sonykuccio is an outdated and proven visitor to hacker community forums,” the scientists stated. “We saw that he started offering DarkEyE in the commencing of 2011. But even prior to making DarkEyE Protector, Sonykuccio was by now furnishing products and services for protecting malware versus anti-viruses (FUD provider) and a spreading assistance for malware.”

Managing the title and affiliated email tackle by way of publicly obtainable leaked e-mail databases turned up many entries similar to “Sonykuccio,” such as a strike that tied the e-mail address to the title “Sebastiano Dragna.”

“Let’s now refer to the Privacy Plan portion on the site securitycode.eu,” according to the report. “We see the exact same identify! The homeowners of this business need to sincerely believe in their have innocence if they dare to publish actual names on the web page.”

The web site in fact frames CloudEyE as possessing been made by a genuine enterprise, and the spokesperson maintains that hacking is at the rear of any tie to Sonykuccio: “We do not have any link to ‘sonykuccio’ due to the fact that account has been compromised as a result of some leaks.”

Even so, the obfuscated malware that Examine Level claimed is created by CloudEyE – GuLoader, in other text – is demonstrating up in hundreds of assaults each and every working day in distinct campaigns, researchers stated – most of them rolled out by unsophisticated risk actors. In reality, up to a quarter of all packed samples that Test Point detects are GuLoaders. The dropper in change provides “a large variety of malware varieties,” from lots of unique menace actors.

“CloudEyE operations may seem legal, but the company presented by CloudEyE has been a prevalent denominator in thousands of assaults over the previous year,” Look at Place concluded. “Code randomization, evasion procedures and payload encryption utilized in CloudEyE secure malware from being detected by quite a few of the existing stability solutions on the industry. Shockingly, this kind of a support is delivered by a legally registered Italian company that operates a publicly offered site which has existed for extra than four many years.”